A critical Server-Side Request Forgery vulnerability in OpenClaw allows authenticated attackers to perform unauthorized network requests from the host environment, risking internal network exposure.

The application fails to properly validate the gatewayUrl parameter within its Gateway tool, resulting in a Server-Side Request Forgery (CWE-918). This flaw allows an authenticated operator or user with the ability to trigger tool calls to force the OpenClaw host to connect to arbitrary endpoints, including local services or cloud metadata addresses.

The ability to perform SSRF poses a significant risk to the integrity and confidentiality of the internal network. By leveraging this vulnerability, an attacker can probe internal services that are not exposed to the public internet, potentially accessing sensitive cloud metadata or internal administrative interfaces, resulting in unauthorized data access or service disruption. Given the CVSS score of 7.6, this vulnerability is classified as High severity and requires prompt remediation to prevent lateral movement within the infrastructure.

Immediate Action: Update the OpenClaw package to version 2026.2.14 or later to implement proper validation and allowlisting for gateway connections.

Proactive Monitoring: Review application and system logs for unusual outbound connection patterns or attempts to reach restricted internal IP ranges from the OpenClaw host.

Compensating Controls: Implement strict egress filtering on the host machine to restrict outbound traffic to known, authorized destinations, effectively limiting the impact of potential SSRF attempts.

Public Exploit Available: Unknown

The vulnerability represents a substantial security oversight that could be leveraged for internal network reconnaissance or service exploitation. Organizations should prioritize updating to version 2026.2.14 immediately to close the SSRF vector. If an immediate update is not feasible, restrict the ability of untrusted users to invoke tools that accept gatewayUrl overrides until the patch can be deployed.